electron-builder uses mksquashfs options that are incompatible with snap store

[jdstrand]

I am a snap store reviewer. We've recently re-enabled our resquashfs tests and noticed that electron snaps are now failing automated review with messages like this:

Errors
------
 - security-snap-v2:squashfs_repack_checksum
	checksums do not match. Please ensure the snap is created with either 'snapcraft pack <DIR>' (using snapcraft >= 2.38) or 'mksquashfs <dir> <snap> -noappend -comp xz -all-root -no-xattrs -no-fragments'

At a high-level, the 'resquash tests' consist of unsquashing the uploaded snap, then running mksquashfs on it to generate a new snap, then checking the hash of the original and resquashed snaps. The store therefore expects that mksquashfs is invoked with expected options (a new enough snapcraft will do this for you with the 'snapcraft pack' command (the last step in a snapcraft build)).

Looking at an affected snap, I see that it is using a non-default blocksize:

$ unsquashfs -s ~/path/to/snap
...
Filesystem size 124212.66 Kbytes (121.30 Mbytes)
Compression xz
Block size 1048576
...

Looking at scripts/snap-template.sh in electron-builder, I see that it uses:

$ mksquashfs ~/squashfs-root /media/psf/test/electron-template-1.snap -b 1048576 -comp xz -Xdict-size 100% -noappend -comp xz -no-xattrs -no-fragments -all-root

The above adds -b 1048576 -comp xz -Xdict-size 100% to mksquashfs options, which causes the resquashed snap to have a different hash.

I'm not an electron-builder developer so I'm not sure how this template script affects normal builds, but I can say that if I unsquash the affected snap, then resquash using 'snapcraft pack /path/to/squashfs-root' that its superblock has:

$ unsquashfs -s /path/to/snap/with/expected/options 
...
Filesystem size 133439.50 Kbytes (130.31 Mbytes)
Compression xz
Block size 131072
...

and this resquashed snap passes review. I suspect you used the -b and -Xdict-size arguments to reduce the on disk file size, however this is incompatible with expected options for the snap store (due note that delta uploads and downloads should help with the larger file size of the expected options).

The bottom line is that in order for snap to pass snap store review, electron-builder needs to use 'snapcraft pack <dir>' with snapcraft >= 2.38 or generate squashfs files with only the supported options (ie, 'mksquashfs <dir> <snap> -noappend -comp xz -all-root -no-xattrs -no-fragments').

Thanks!

Reference: https://forum.snapcraft.io/t/automated-reviews-and-snapcraft-2-38/4982/8

[jdstrand]

FYI, if you want to test for yourself if a snap will pass automated review, you can do:

$ sudo snap install review-tools
$ snap-review /path/to/snap

Eg:

$ snap-review ./review-tools_285.snap # non-electron app
./review-tools_285.snap: pass`

$ snap-review ./termius-beta_4.snap # electron app
Errors
------
 - security-snap-v2:squashfs_repack_checksum
	checksums do not match. Please ensure the snap is created with either 'snapcraft pack <DIR>' (using snapcraft >= 2.38) or 'mksquashfs <dir> <snap> -noappend -comp xz -all-root -no-xattrs -no-fragments'
./termius-beta_4.snap: FAIL

[jdstrand]

My recommendation to fix this bug would be to use 'snapcraft pack <dir>' so you don't have to worry about this again.

[develar]

-Xdict-size 100% -b 1048576 removed.

[jdstrand]

@develar - thanks for taking care of this! I'm not sure how electron-builder consumers get fixes like this. When will it be available to your users? (I'd like to add a message to our review-tools to point users to the new release).

[develar]

Fixed in 20.9.2 and marked as latest stable release.